Content-Security-Policy

Rules for which scripts, styles, images and connections a page may load, to block injected code (XSS).

Header name, or pasted headers

Explained

Examples

Example

Content-Security-Policy: default-src 'self'; img-src 'self' data:

Adding 'unsafe-inline' for scripts removes most of the protection. Start with Content-Security-Policy-Report-Only to see what would break.

Defined in W3C CSP Level 3.